I am working on a PHP/MySQL messaging application in which a user can see a conversation and reply to it. On the view page of the message I have a reply field. To save the reply I need to know the ID of the message which is being replied to. I have been trying to pass this ID in a way, which is both secure and reliable. A simple hidden field with a POST won’t do it, since the user can tamper the data and modify which message he is answering. Creating a session variable with the id of the message on the view page provides the security but causes a highly undesirable side-effect: if the user views another message after opening the one he is replying to, the response will be posted to the other message.
Any one got any alternatives ?
You can encrypt the id with the mcrypt library and pass the encrypted form in the url. If your userbase has the collective IQ of a zucchini, you could probably get away with simple obfuscating as Hex or base64. But otherwise, mcrypt->base64 will be more than enough